<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html><head>


<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta name="robots" content="index,nofollow">

<title>SettingUpNFSHowTo - Community Ubuntu Documentation</title>
<script type="text/javascript" src="SettingUpNFSHowTo_files/common.js"></script>

<script type="text/javascript">
<!--
var search_hint = "Search";
//-->
</script>


<link rel="stylesheet" type="text/css" charset="utf-8" media="all" href="SettingUpNFSHowTo_files/common.css">
<link rel="stylesheet" type="text/css" charset="utf-8" media="screen" href="SettingUpNFSHowTo_files/screen.css">
<link rel="stylesheet" type="text/css" charset="utf-8" media="print" href="SettingUpNFSHowTo_files/print.css">
<link rel="stylesheet" type="text/css" charset="utf-8" media="projection" href="SettingUpNFSHowTo_files/projection.css">

<!-- css only for MSIE browsers -->
<!--[if IE]>
   <link rel="stylesheet" type="text/css" charset="utf-8" media="all" href="/htdocs/ubuntunew/css/msie.css">
<![endif]-->



<link rel="Start" href="https://help.ubuntu.com/community/UserDocumentation">
<link rel="Alternate" title="Wiki Markup" href="https://help.ubuntu.com/community/SettingUpNFSHowTo?action=raw">
<link rel="Alternate" media="print" title="Print View" href="https://help.ubuntu.com/community/SettingUpNFSHowTo?action=print">
<link rel="Search" href="https://help.ubuntu.com/community/FindPage">
<link rel="Index" href="https://help.ubuntu.com/community/TitleIndex">
<link rel="Glossary" href="https://help.ubuntu.com/community/WordIndex">
<link rel="Help" href="https://help.ubuntu.com/community/HelpOnFormatting">
</head><body dir="ltr" lang="en">

<div id="round" class="roundme">
<img id="topcap" alt="" src="SettingUpNFSHowTo_files/cap-top.png">
<div id="layout" class="container clear-block">
<div id="header">
<div id="logo-floater">
<h1><a href="http://help.ubuntu.com/" title="Ubuntu Documentation"><img alt="Ubuntu" id="logo" src="SettingUpNFSHowTo_files/logo.png"></a></h1>
</div>

<noscript>
 <form action="http://www.google.com/cse" id="cse-search-box">
   <div>
     <input type="hidden" name="cx" value="004599128559784038176:vj_p0xo-nng" />
     <input type="hidden" name="ie" value="UTF-8" />
     <input type="text" name="q" size="27" />
     <input type="submit" name="sa" value="Search" />
   </div>
 </form>
</noscript>

<script>
 document.write('<form action="https://help.ubuntu.com/search.html" id="cse-search-box">');
 document.write('  <div>');
 document.write('    <input type="hidden" name="cof" value="FORID:9" />');
 document.write('    <input type="hidden" name="cx" value="004599128559784038176:vj_p0xo-nng" />');
 document.write('    <input type="hidden" name="ie" value="UTF-8" />');
 document.write('    <input type="text" name="q" size="27" />');
 document.write('    <input type="submit" name="sa" value="Search" />');
 document.write('  </div>');
 document.write('</form>');
</script><form action="https://help.ubuntu.com/search.html" id="cse-search-box">  <div>    <input name="cof" value="FORID:9" type="hidden">    <input name="cx" value="004599128559784038176:vj_p0xo-nng" type="hidden">    <input name="ie" value="UTF-8" type="hidden">    <input name="q" size="27" type="text">    <input name="sa" value="Search" type="submit">  </div></form>

<div id="sitename"><a href="https://help.ubuntu.com/community"><img src="SettingUpNFSHowTo_files/help-faq.png"><span>Community Documentation</span></a></div>
</div> <!--header-->
<ul id="loginbar"><li><a href="https://help.ubuntu.com/community/SettingUpNFSHowTo?action=login" id="login" rel="nofollow">Login to Edit</a></li></ul>


<!--1-->
<div id="page" dir="ltr" lang="en">

<!--2-->

<div id="breadcrumbs">
<a href="https://help.ubuntu.com/">Ubuntu Documentation</a> &gt; <a href="https://help.ubuntu.com/community">Community Documentation</a> &gt; <a class="backlink" href="https://help.ubuntu.com/community/SettingUpNFSHowTo?action=fullsearch&amp;context=180&amp;value=linkto%3A%22SettingUpNFSHowTo%22" rel="nofollow" title="Click to do a full-text search for this title">SettingUpNFSHowTo</a>
</div>


<ul id="pagelocation">
<li><a class="backlink" href="https://help.ubuntu.com/community/SettingUpNFSHowTo?action=fullsearch&amp;context=180&amp;value=linkto%3A%22SettingUpNFSHowTo%22" rel="nofollow" title="Click to do a full-text search for this title">SettingUpNFSHowTo</a></li>
</ul>

<!--3--><div dir="ltr" id="content" lang="en"><span class="anchor" id="top"></span>
<span class="anchor" id="line-1"></span><div><table style="float: right; font-size: 0.9em; width: 40%; background: none repeat scroll 0% 0% rgb(241, 241, 237); margin: 0pt 0pt 1em 1em;"><tbody><tr>  <td style="padding: 0.5em;"><p class="line891"></p><div class="table-of-contents"><p class="table-of-contents-heading">Contents</p><ol><li><a href="#Introduction">Introduction</a></li><li><a href="#NFSv4%20quick%20start">NFSv4 quick start</a><ol><li><a href="#NFSv4%20server">NFSv4 server</a></li><li><a href="#NFSv4%20client">NFSv4 client</a></li></ol></li><li><a href="#NFS%20Server">NFS Server</a><ol><li><a href="#Pre-Installation%20Setup">Pre-Installation Setup</a><ol><li><ol><li><a href="#User%20Permissions">User Permissions</a></li><li><a href="#Group%20Permissions">Group Permissions</a></li><li><a href="#Host%20Names">Host Names</a></li><li><a href="#NIS">NIS</a></li><li><a href="#Portmap%20Lockdown">Portmap Lockdown</a></li></ol></li></ol></li><li><a href="#Installation%20and%20Configuration">Installation and Configuration</a><ol><li><ol><li><a href="#Install%20NFS%20Server">Install NFS Server</a></li><li><a href="#Shares">Shares</a></li><li><a href="#Restart%20Services">Restart Services</a></li></ol></li><li><a href="#Security%20Note">Security Note</a></li></ol></li></ol></li><li><a href="#NFS%20Client">NFS Client</a><ol><li><a href="#Installation">Installation</a><ol><li><ol><li><a href="#Portmap%20Lockdown">Portmap Lockdown</a></li><li><a href="#Host%20Names">Host Names</a></li></ol></li><li><a href="#Mounts">Mounts</a><ol><li><a href="#Check%20to%20see%20if%20everything%20works">Check to see if everything works</a></li><li><a href="#Mount%20at%20startup">Mount at startup</a></li><li><a href="#Automounter">Automounter</a></li><li><a href="#Static%20Mounts">Static Mounts</a></li></ol></li><li><a href="#Notes">Notes</a><ol><li><a href="#Minimalistic%20NFS%20Set%20Up">Minimalistic NFS Set Up</a></li><li><a href="#Using%20Groups%20with%20NFS%20Shares">Using Groups with NFS Shares</a></li></ol></li></ol></li><li><a href="#IPSec%20Notes">IPSec Notes</a></li><li><a href="#Troubleshooting">Troubleshooting</a><ol><li><a href="#Mounting%20NFS%20shares%20in%20encrypted%20home%20won%27t%20work%20on%20boot">Mounting NFS shares in encrypted home won't work on boot</a></li></ol></li><li><a href="#links">links</a></li><li><a href="#Credits">Credits</a></li></ol></li></ol></div></td>
</tr>
</tbody></table></div><span class="anchor" id="line-2"></span><span class="anchor" id="line-3"></span><p class="line867">
</p><h1 id="Introduction">Introduction</h1>
<span class="anchor" id="line-4"></span><span class="anchor" id="line-5"></span><p class="line874">NFS
 (Network File System) allows you to 'share' a directory located on one 
networked computer with other computers/devices on that network. The 
computer 'sharing' the directory is called the server and the computers 
or devices connecting to that server are called clients. The clients 
'mount' the shared directory, it becomes part of their own directory 
structure. <span class="anchor" id="line-6"></span><span class="anchor" id="line-7"></span></p><p class="line874">NFS
 is perfect for a NAS (Networked Attached Storage) deployment in a 
Linux/Unix environment. It is a native Linux/Unix protocol as opposed to
 Samba which uses the SMB protocol developed by Microsoft. The Apple OS 
has good support for NFS. Windows 7 has some support for NFS. <span class="anchor" id="line-8"></span><span class="anchor" id="line-9"></span></p><p class="line874">NFS
 is perhaps best for more 'permanent' network mounted directories such 
as /home directories or regularly accessed shared resources. If you want
 a network share that guest users can easily connect to, Samba is more 
suited. This is because tools exist more readily across operating 
systems to temporarily mount and detach from Samba shares. <span class="anchor" id="line-10"></span><span class="anchor" id="line-11"></span></p><p class="line874">Before deploying NFS you should be familiar with: <span class="anchor" id="line-12"></span><span class="anchor" id="line-13"></span></p><ul><li>Linux file and directory permissions <span class="anchor" id="line-14"></span></li><li>Mounting and detaching (unmounting) filesystems <span class="anchor" id="line-15"></span><span class="anchor" id="line-16"></span></li></ul><p class="line867">
</p><h1 id="NFSv4 quick start">NFSv4 quick start</h1>
<span class="anchor" id="line-17"></span><span class="anchor" id="line-18"></span><p class="line874">Providing
 you understand what you are doing, use this brief walk-through to set 
up an NFSv4 server on Ubuntu (with no authentication security). Then 
mount the share on an Ubuntu client. It has been tested on Ubuntu 10.04 
Lucid Lynx.  <span class="anchor" id="line-19"></span><span class="anchor" id="line-20"></span></p><p class="line867">
</p><h2 id="NFSv4 server">NFSv4 server</h2>
<span class="anchor" id="line-21"></span><span class="anchor" id="line-22"></span><p class="line874">Install the required packages... <span class="anchor" id="line-23"></span><span class="anchor" id="line-24"></span></p><ul><li style="list-style-type: none;"><span class="anchor" id="line-25"></span><pre># apt-get install nfs-kernel-server </pre><span class="anchor" id="line-26"></span><span class="anchor" id="line-27"></span></li></ul><p class="line862">NFSv4 exports exist in a single <em>pseudo filesystem</em>, where the <span class="anchor" id="line-28"></span>real directories are mounted with the <tt>--bind</tt> option. <span class="anchor" id="line-29"></span><span class="anchor" id="line-30"></span></p><ul><li style="list-style-type: none;"><p class="line862">Let's say we want to export our users' home directories in <tt>/home/users</tt>. First we create the export filesystem: <span class="anchor" id="line-31"></span><span class="anchor" id="line-32"></span><span class="anchor" id="line-33"></span></p><pre># mkdir -p /export/users </pre><span class="anchor" id="line-34"></span><span class="anchor" id="line-35"></span>and mount the real users directory with: <span class="anchor" id="line-36"></span><span class="anchor" id="line-37"></span><span class="anchor" id="line-38"></span><pre># mount --bind /home/users /export/users</pre><span class="anchor" id="line-39"></span><span class="anchor" id="line-40"></span>To save us from retyping this after every reboot we add the following <span class="anchor" id="line-41"></span><p class="line862">line to <tt>/etc/fstab</tt> <span class="anchor" id="line-42"></span><span class="anchor" id="line-43"></span></p><pre>/home/users    /export/users   none    bind  0  0</pre><span class="anchor" id="line-44"></span><span class="anchor" id="line-45"></span></li></ul><p class="line862">There are three configuration files that relate to an NFSv4 server: <tt>/etc/default/nfs-kernel-server</tt>, <tt>/etc/default/nfs-common</tt> and <tt>/etc/exports</tt>. <span class="anchor" id="line-46"></span><span class="anchor" id="line-47"></span></p><ul><li style="list-style-type: none;">Those config files in our example would look like this: <span class="anchor" id="line-48"></span><span class="anchor" id="line-49"></span><p class="line862">In <tt>/etc/default/nfs-kernel-server</tt> we set: <span class="anchor" id="line-50"></span><span class="anchor" id="line-51"></span></p><pre>NEED_SVCGSSD=no # no is default</pre><span class="anchor" id="line-52"></span>because we are not activating NFSv4 security this time. <span class="anchor" id="line-53"></span><span class="anchor" id="line-54"></span><p class="line862">In <tt>/etc/default/nfs-common</tt> we set: <span class="anchor" id="line-55"></span><span class="anchor" id="line-56"></span><span class="anchor" id="line-57"></span></p><pre>NEED_IDMAPD=yes
NEED_GSSD=no # no is default</pre><span class="anchor" id="line-58"></span>because we want UID/GUID to be mapped from names.   <span class="anchor" id="line-59"></span><span class="anchor" id="line-60"></span></li></ul><p class="line862">In order for the ID names to be automatically mapped, both the client and server require the <tt>/etc/idmapd.conf</tt> file to have the same contents with the correct domain names.   Furthermore, this file should have the following lines in the <tt>Mapping</tt> section: <span class="anchor" id="line-61"></span></p><ul><li style="list-style-type: none;"><span class="anchor" id="line-62"></span><span class="anchor" id="line-63"></span><span class="anchor" id="line-64"></span><span class="anchor" id="line-65"></span><span class="anchor" id="line-66"></span><pre>[Mapping]

Nobody-User = nobody
Nobody-Group = nogroup</pre><span class="anchor" id="line-67"></span><p class="line862">However, the client may have different requirements for the <tt>Nobody-User</tt> and <tt>Nobody-Group</tt>.  For example on <a class="nonexistent" href="https://help.ubuntu.com/community/RedHat">RedHat</a>  variants, it's <tt>nfsnobody</tt> for both.  <tt>cat&nbsp;/etc/passwd</tt> and <tt>cat&nbsp;/etc/group</tt> should show the "nobody" accounts.  <span class="anchor" id="line-68"></span><span class="anchor" id="line-69"></span></p></li></ul><p class="line862">This way, server and client do not need the users to share same UID/GUID. <br>
<br>
 <span class="anchor" id="line-70"></span><span class="anchor" id="line-71"></span></p><ul><li style="list-style-type: none;">To export our directories to a local network 192.168.1.0/24 <span class="anchor" id="line-72"></span><p class="line862">we add the following two lines to <tt>/etc/exports</tt> <span class="anchor" id="line-73"></span><span class="anchor" id="line-74"></span><span class="anchor" id="line-75"></span><span class="anchor" id="line-76"></span></p><pre>/export       192.168.1.0/24(rw,fsid=0,insecure,no_subtree_check,async)
/export/users 192.168.1.0/24(rw,nohide,insecure,no_subtree_check,async)</pre><span class="anchor" id="line-77"></span><span class="anchor" id="line-78"></span></li></ul><p class="line874">Now restart the service <span class="anchor" id="line-79"></span></p><ul><li style="list-style-type: none;"><span class="anchor" id="line-80"></span><pre># /etc/init.d/nfs-kernel-server restart</pre><span class="anchor" id="line-81"></span><span class="anchor" id="line-82"></span></li></ul><p class="line867">
</p><h2 id="NFSv4 client">NFSv4 client</h2>
<span class="anchor" id="line-83"></span><span class="anchor" id="line-84"></span><p class="line874">Install the required packages... <span class="anchor" id="line-85"></span><span class="anchor" id="line-86"></span></p><ul><li style="list-style-type: none;"><span class="anchor" id="line-87"></span><pre># apt-get install nfs-common </pre><span class="anchor" id="line-88"></span><span class="anchor" id="line-89"></span></li></ul><p class="line862">The client needs the same changes to <tt>/etc/default/nfs-common</tt> to connect to an NFSv4 server. <span class="anchor" id="line-90"></span><span class="anchor" id="line-91"></span></p><ul><li style="list-style-type: none;"><p class="line862">In <tt>/etc/default/nfs-common</tt> we set: <span class="anchor" id="line-92"></span><span class="anchor" id="line-93"></span><span class="anchor" id="line-94"></span></p><pre>NEED_IDMAPD=yes
NEED_GSSD=no # no is default</pre><span class="anchor" id="line-95"></span><p class="line862">because
 we want UID/GUID to be mapped from names. This way, server and client 
do not need the users to share same UID/GUID. Remember that mount/fstab 
defaults to NFSv3, so "mount -t nfs4" is necessary to make this work.<br>
<br>
 <span class="anchor" id="line-96"></span><span class="anchor" id="line-97"></span></p></li></ul><p class="line874">On the client we can mount the complete export tree with one command: <span class="anchor" id="line-98"></span></p><ul><li style="list-style-type: none;"><span class="anchor" id="line-99"></span><pre># mount -t nfs4 -o proto=tcp,port=2049 nfs-server:/ /mnt</pre><span class="anchor" id="line-100"></span><p class="line862">Note that <tt>nfs-server:/export</tt> is not necessary in NFSv4, as it is in NFSv3. The root export <tt>:/</tt> defaults to export with <tt>fsid=0</tt>. <span class="anchor" id="line-101"></span><span class="anchor" id="line-102"></span></p></li></ul><p class="line874">It can fail sometimes with the message  <span class="anchor" id="line-103"></span><span class="anchor" id="line-104"></span><span class="anchor" id="line-105"></span></p><pre>mount.nfs4: No such device</pre><span class="anchor" id="line-106"></span><p class="line874">You have to load the nfs module by giving the command <span class="anchor" id="line-107"></span><span class="anchor" id="line-108"></span><span class="anchor" id="line-109"></span></p><pre># modprobe nfs</pre><span class="anchor" id="line-110"></span><span class="anchor" id="line-111"></span><p class="line862">We can also mount an exported <em>subtree</em> with: <span class="anchor" id="line-112"></span></p><ul><li style="list-style-type: none;"><span class="anchor" id="line-113"></span><pre># mount -t nfs4 -o proto=tcp,port=2049 nfs-server:/users /home/users</pre><span class="anchor" id="line-114"></span><span class="anchor" id="line-115"></span></li></ul><p class="line862">To save us from retyping this after every reboot we add the following line to <tt>/etc/fstab</tt>: <span class="anchor" id="line-116"></span></p><ul><li style="list-style-type: none;"><span class="anchor" id="line-117"></span><pre>nfs-server:/   /mnt   nfs4    _netdev,auto  0  0</pre><span class="anchor" id="line-118"></span><p class="line862">The <tt>auto</tt> option mounts on startup and the <tt>_netdev</tt> option waits until system network devices are loaded. However this will not work with <a class="nonexistent" href="https://help.ubuntu.com/community/WiFi">WiFi</a> as <a class="nonexistent" href="https://help.ubuntu.com/community/WiFi">WiFi</a> is set up at the user level (after login) not at system startup. If you use _netdev with <a class="nonexistent" href="https://help.ubuntu.com/community/WiFi">WiFi</a> the boot process will pause waiting for the server to become available. <span class="anchor" id="line-119"></span><span class="anchor" id="line-120"></span></p></li></ul><p class="line874">Note
 that _netdev only works with nfs version 3 and before.  nfs4 ignores 
this option.  Depending on how fast the network comes up on boot the 
mount entry may fail and the system will just keep booting.  It can 
still be useful if you make your own script to wait for the network to 
come up and then mount -a -O _netdev <span class="anchor" id="line-121"></span><span class="anchor" id="line-122"></span></p><p class="line874">Ubuntu Server doesn't come with any init.d/netfs or other scripts to do this for you. <span class="anchor" id="line-123"></span><span class="anchor" id="line-124"></span><span class="anchor" id="line-125"></span><span class="anchor" id="line-126"></span></p><p class="line867">
</p><h1 id="NFS Server">NFS Server</h1>
<span class="anchor" id="line-127"></span><span class="anchor" id="line-128"></span><p class="line867">
</p><h2 id="Pre-Installation Setup">Pre-Installation Setup</h2>
<span class="anchor" id="line-129"></span><p class="line867"><strong>None of the following pre-installation steps are strictly necessary.</strong> <span class="anchor" id="line-130"></span><span class="anchor" id="line-131"></span></p><p class="line867">
</p><h4 id="User Permissions">User Permissions</h4>
<span class="anchor" id="line-132"></span><span class="anchor" id="line-133"></span><p class="line874">NFS
 user permissions are based on user ID (UID). UIDs of any users on the 
client must match those on the server in order for the users to have 
access. The typical ways of doing this are: <span class="anchor" id="line-134"></span><span class="anchor" id="line-135"></span></p><ul><li>Manual password file synchronization <span class="anchor" id="line-136"></span></li><li><p class="line862">Use of <a href="https://help.ubuntu.com/community/LDAPClientAuthentication">LDAP</a> <span class="anchor" id="line-137"></span></p></li><li><p class="line862">Use of <a href="https://help.ubuntu.com/community/SettingUpNISHowTo">NIS</a> <span class="anchor" id="line-138"></span><span class="anchor" id="line-139"></span></p></li></ul><p class="line874">It's also important to note that you have to be careful on <span class="anchor" id="line-140"></span>systems where the main user has root access - that user can change <span class="anchor" id="line-141"></span>UID's on the system to allow themselves access to anyone's files. This <span class="anchor" id="line-142"></span>page assumes that the administrative team is the only group with root <span class="anchor" id="line-143"></span>access and that they are all trusted. Anything else represents a more <span class="anchor" id="line-144"></span>advanced configuration, and will not be addressed here. <span class="anchor" id="line-145"></span><span class="anchor" id="line-146"></span></p><p class="line867">
</p><h4 id="Group Permissions">Group Permissions</h4>
<span class="anchor" id="line-147"></span><span class="anchor" id="line-148"></span><p class="line874">With
 NFS, a user's access to files is determined by his/her membership of 
groups on the client, not on the server.  However, there is an important
 limitation: a maximum of 16 groups are passed from the client to the 
server, and, if a user is member of more than 16 groups on the client, 
some files or directories might be unexpectedly inaccessible. <span class="anchor" id="line-149"></span><span class="anchor" id="line-150"></span></p><p class="line867">
</p><h4 id="Host Names">Host Names</h4>
<span class="anchor" id="line-151"></span><p class="line867"><small>optional if using DNS </small> <span class="anchor" id="line-152"></span><span class="anchor" id="line-153"></span></p><p class="line862">Add any client name and IP addresses to /etc/hosts. The <em>real</em> (not 127.0.0.1) IP address of the server should already be here. This ensures that NFS will still work even if <span class="anchor" id="line-154"></span>DNS goes down. You could rely on DNS if you wanted, it's up to you. <span class="anchor" id="line-155"></span><span class="anchor" id="line-156"></span></p><p class="line867">
</p><h4 id="NIS">NIS</h4>
<span class="anchor" id="line-157"></span><p class="line867"><small>optional - perform steps only if using NIS </small> <span class="anchor" id="line-158"></span><span class="anchor" id="line-159"></span></p><p class="line867"><strong>Note:</strong> This <strong>only</strong> works if using NIS. Otherwise, you can't use netgroups, and should specify individual IP's or hostnames in <tt>/etc/exports</tt>. Read the <strong>BUGS</strong> section in <tt>man&nbsp;netgroup</tt>. <span class="anchor" id="line-160"></span><span class="anchor" id="line-161"></span></p><p class="line874">Edit /etc/netgroup and add a line to classify your clients. (This <span class="anchor" id="line-162"></span>step is not necessary, but is for convenience). <span class="anchor" id="line-163"></span><span class="anchor" id="line-164"></span><span class="anchor" id="line-165"></span></p><pre>myclients (client1,,) (client2,,)</pre><span class="anchor" id="line-166"></span><p class="line862">Obviously, more clients can be added. <tt>myclients</tt> can be anything <span class="anchor" id="line-167"></span>you like; this is a <em>netgroup name</em>. <span class="anchor" id="line-168"></span><span class="anchor" id="line-169"></span></p><p class="line874">Run this command to rebuild the YP database: <span class="anchor" id="line-170"></span><span class="anchor" id="line-171"></span><span class="anchor" id="line-172"></span></p><pre>sudo make -C /var/yp</pre><span class="anchor" id="line-173"></span><span class="anchor" id="line-174"></span><p class="line867">
</p><h4 id="Portmap Lockdown">Portmap Lockdown</h4>
<span class="anchor" id="line-175"></span><p class="line867"><small>optional </small> <span class="anchor" id="line-176"></span><span class="anchor" id="line-177"></span></p><p class="line874">Add the following line to /etc/hosts.deny: <span class="anchor" id="line-178"></span><span class="anchor" id="line-179"></span><span class="anchor" id="line-180"></span></p><pre>portmap mountd nfsd statd lockd rquotad : ALL</pre><span class="anchor" id="line-181"></span><p class="line874">By blocking all clients first, only clients in /etc/hosts.allow below will be allowed to access the server. <span class="anchor" id="line-182"></span><span class="anchor" id="line-183"></span></p><p class="line874">Now add the following line to /etc/hosts.allow: <span class="anchor" id="line-184"></span><span class="anchor" id="line-185"></span><span class="anchor" id="line-186"></span></p><pre>portmap mountd nfsd statd lockd rquotad : list of IP addresses</pre><span class="anchor" id="line-187"></span><p class="line874">Where the "list of IP addresses" string is, you need to make a list <span class="anchor" id="line-188"></span>of IP addresses that consists of the server and all clients. These have <span class="anchor" id="line-189"></span>to be IP addresses because of a limitation in portmap (it doesn't like <span class="anchor" id="line-190"></span>hostnames). Note that if you have NIS set up, just add these to the <span class="anchor" id="line-191"></span>same line. <span class="anchor" id="line-192"></span><span class="anchor" id="line-193"></span></p><p class="line867">
</p><h2 id="Installation and Configuration">Installation and Configuration</h2>
<span class="anchor" id="line-194"></span><span class="anchor" id="line-195"></span><p class="line867">
</p><h4 id="Install NFS Server">Install NFS Server</h4>
<span class="anchor" id="line-196"></span><span class="anchor" id="line-197"></span><p class="line867"><span class="anchor" id="line-198"></span><span class="anchor" id="line-199"></span></p><pre>sudo apt-get install portmap nfs-kernel-server</pre><span class="anchor" id="line-200"></span><span class="anchor" id="line-201"></span><p class="line867">
</p><h4 id="Shares">Shares</h4>
<span class="anchor" id="line-202"></span><span class="anchor" id="line-203"></span><p class="line874">Edit /etc/exports and add the shares: <span class="anchor" id="line-204"></span><span class="anchor" id="line-205"></span><span class="anchor" id="line-206"></span><span class="anchor" id="line-207"></span></p><pre>/home @myclients(rw,sync,no_subtree_check)
/usr/local @myclients(rw,sync,no_subtree_check)</pre><span class="anchor" id="line-208"></span><span class="anchor" id="line-209"></span><p class="line874">The above shares /home and /usr/local to all clients in the <span class="anchor" id="line-210"></span>myclients netgroup. <span class="anchor" id="line-211"></span><span class="anchor" id="line-212"></span></p><p class="line867"><span class="anchor" id="line-213"></span><span class="anchor" id="line-214"></span><span class="anchor" id="line-215"></span></p><pre>/home 192.168.0.10(rw,sync,no_subtree_check) 192.168.0.11(rw,sync,no_subtree_check)
/usr/local 192.168.0.10(rw,sync,no_subtree_check) 192.168.0.11(rw,sync,no_subtree_check)</pre><span class="anchor" id="line-216"></span><span class="anchor" id="line-217"></span><p class="line874">The above shares /home and /usr/local to two clients with fixed ip addresses. <span class="anchor" id="line-218"></span>Best used only with machines that have static ip addresses. <span class="anchor" id="line-219"></span><span class="anchor" id="line-220"></span></p><p class="line867"><span class="anchor" id="line-221"></span><span class="anchor" id="line-222"></span><span class="anchor" id="line-223"></span></p><pre>/home 192.168.0.0/255.255.255.0(rw,sync,no_subtree_check)
/usr/local 192.168.0.0/255.255.255.0(rw,sync,no_subtree_check)</pre><span class="anchor" id="line-224"></span><span class="anchor" id="line-225"></span><p class="line874">The above shares /home and /usr/local to all clients in the <span class="anchor" id="line-226"></span>private network falling within the designated ip address range. <span class="anchor" id="line-227"></span><span class="anchor" id="line-228"></span></p><p class="line867"><tt>rw</tt> makes the share read/write, and <tt>sync</tt> requires <span class="anchor" id="line-229"></span>the server to only reply to requests once any changes have been flushed <span class="anchor" id="line-230"></span>to disk. This is the safest option (<tt>async</tt> is faster, but <span class="anchor" id="line-231"></span>dangerous. It is strongly recommended that you read <tt>man&nbsp;exports</tt>. <span class="anchor" id="line-232"></span><span class="anchor" id="line-233"></span></p><p class="line874">After setting up /etc/exports, export the shares: <span class="anchor" id="line-234"></span><span class="anchor" id="line-235"></span><span class="anchor" id="line-236"></span></p><pre>sudo exportfs -ra</pre><span class="anchor" id="line-237"></span><span class="anchor" id="line-238"></span><p class="line862">You'll want to do this command whenever <tt>/etc/exports</tt> is modified. <span class="anchor" id="line-239"></span><span class="anchor" id="line-240"></span></p><p class="line867">
</p><h4 id="Restart Services">Restart Services</h4>
<span class="anchor" id="line-241"></span><span class="anchor" id="line-242"></span><p class="line874">By
 default, portmap only binds to the loopback interface. To enable access
 to portmap from remote machines, you need to change 
/etc/default/portmap to get rid of either "-l" or "-i 127.0.0.1". <span class="anchor" id="line-243"></span><span class="anchor" id="line-244"></span></p><p class="line874">If /etc/default/portmap was changed, portmap will need to be restarted:  <span class="anchor" id="line-245"></span><span class="anchor" id="line-246"></span><span class="anchor" id="line-247"></span></p><pre>sudo /etc/init.d/portmap restart</pre><span class="anchor" id="line-248"></span><span class="anchor" id="line-249"></span><p class="line874">The NFS kernel server will also require a restart:  <span class="anchor" id="line-250"></span><span class="anchor" id="line-251"></span><span class="anchor" id="line-252"></span></p><pre>sudo /etc/init.d/nfs-kernel-server restart</pre><span class="anchor" id="line-253"></span><span class="anchor" id="line-254"></span><p class="line867">
</p><h3 id="Security Note">Security Note</h3>
<span class="anchor" id="line-255"></span><span class="anchor" id="line-256"></span><p class="line874">Aside from the UID issues discussed above, it should be noted that an <span class="anchor" id="line-257"></span>attacker could potentially masquerade as a machine that is allowed to <span class="anchor" id="line-258"></span>map the share, which allows them to create arbitrary UIDs to access <span class="anchor" id="line-259"></span>your files. One potential solution to this is <a href="https://help.ubuntu.com/community/IPSecHowTo">IPSec</a>,
 see also the NFS and IPSec section below. You can set up all your 
domain members to talk only to each other over IPSec, which will 
effectively authenticate that your client is who it says it is. <span class="anchor" id="line-260"></span><span class="anchor" id="line-261"></span></p><p class="line874">IPSec works by encrypting traffic to the server with the server's key, <span class="anchor" id="line-262"></span>and the server sends back all replies encrypted with the client's key. <span class="anchor" id="line-263"></span>The
 traffic is decrypted with the respective keys. If the client doesn't 
have the keys that the client is supposed to have, it can't send or 
receive data. <span class="anchor" id="line-264"></span><span class="anchor" id="line-265"></span></p><p class="line874">An
 alternative to IPSec is physically separate networks. This requires a 
separate network switch and separate ethernet cards, and physical 
security of that network. <span class="anchor" id="line-266"></span><span class="anchor" id="line-267"></span></p><p class="line867">
</p><h1 id="NFS Client">NFS Client</h1>
<span class="anchor" id="line-268"></span><span class="anchor" id="line-269"></span><p class="line867">
</p><h2 id="Installation">Installation</h2>
<span class="anchor" id="line-270"></span><span class="anchor" id="line-271"></span><p class="line867"><span class="anchor" id="line-272"></span><span class="anchor" id="line-273"></span></p><pre>sudo apt-get install portmap nfs-common</pre><span class="anchor" id="line-274"></span><span class="anchor" id="line-275"></span><p class="line867">
</p><h4 id="Portmap Lockdown">Portmap Lockdown</h4>
<span class="anchor" id="line-276"></span><span class="anchor" id="line-277"></span><p class="line867"><small>optional </small> <span class="anchor" id="line-278"></span><span class="anchor" id="line-279"></span></p><p class="line874">Add the following line to /etc/hosts.deny: <span class="anchor" id="line-280"></span><span class="anchor" id="line-281"></span><span class="anchor" id="line-282"></span></p><pre>portmap : ALL</pre><span class="anchor" id="line-283"></span><p class="line874">By blocking all clients first, only clients in /etc/hosts.allow below will be allowed to access the server. <span class="anchor" id="line-284"></span><span class="anchor" id="line-285"></span></p><p class="line874">Now add the following line to /etc/hosts.allow: <span class="anchor" id="line-286"></span><span class="anchor" id="line-287"></span><span class="anchor" id="line-288"></span></p><pre>portmap : NFS server IP address</pre><span class="anchor" id="line-289"></span><p class="line862">Where "NFS server IP address" is the IP address of the server. <strong>This must be numeric!</strong> It's the way portmap works. <span class="anchor" id="line-290"></span><span class="anchor" id="line-291"></span></p><p class="line867">
</p><h4 id="Host Names">Host Names</h4>
<span class="anchor" id="line-292"></span><span class="anchor" id="line-293"></span><p class="line867"><small>optional if using DNS </small> <span class="anchor" id="line-294"></span><span class="anchor" id="line-295"></span></p><p class="line874">Add the server name to /etc/hosts.  This ensures the NFS mounts will still work even if <span class="anchor" id="line-296"></span>DNS goes down. You could rely on DNS if you wanted, it's up to you. <span class="anchor" id="line-297"></span><span class="anchor" id="line-298"></span></p><p class="line867">
</p><h3 id="Mounts">Mounts</h3>
<span class="anchor" id="line-299"></span><span class="anchor" id="line-300"></span><span class="anchor" id="line-301"></span><p class="line867">
</p><h4 id="Check to see if everything works">Check to see if everything works</h4>
<span class="anchor" id="line-302"></span><span class="anchor" id="line-303"></span><p class="line874">You should try and mount it now. The basic template you will use is: <span class="anchor" id="line-304"></span><span class="anchor" id="line-305"></span><span class="anchor" id="line-306"></span></p><pre>sudo mount ServerIP:/folder/already/setup/to/be/shared /home/username/folder/in/your/local/computer</pre><span class="anchor" id="line-307"></span><span class="anchor" id="line-308"></span><p class="line874">so for example: <span class="anchor" id="line-309"></span><span class="anchor" id="line-310"></span></p><p class="line867"><span class="anchor" id="line-311"></span><span class="anchor" id="line-312"></span></p><pre>sudo mount 192.168.1.42:/home/music /home/poningru/music</pre><span class="anchor" id="line-313"></span><span class="anchor" id="line-314"></span><p class="line867">
</p><h4 id="Mount at startup">Mount at startup</h4>
<span class="anchor" id="line-315"></span><span class="anchor" id="line-316"></span><p class="line874">NFS
 mounts can either be automatically mounted when accessed using autofs 
or can be setup with static mounts using entries in /etc/fstab. Both are
 explained below. <span class="anchor" id="line-317"></span><span class="anchor" id="line-318"></span></p><p class="line867">
</p><h4 id="Automounter">Automounter</h4>
<span class="anchor" id="line-319"></span><span class="anchor" id="line-320"></span><p class="line874">Install autofs: <span class="anchor" id="line-321"></span><span class="anchor" id="line-322"></span><span class="anchor" id="line-323"></span></p><pre>sudo apt-get install autofs</pre><span class="anchor" id="line-324"></span><span class="anchor" id="line-325"></span><p class="line874">The
 following configuration example sets up home directories to automount 
off an NFS server upon logging in.  Other directories can be setup to 
automount upon access as well. <span class="anchor" id="line-326"></span><span class="anchor" id="line-327"></span></p><p class="line874">Add the following line to the end of /etc/auto.master: <span class="anchor" id="line-328"></span><span class="anchor" id="line-329"></span><span class="anchor" id="line-330"></span></p><pre>  /home         /etc/auto.home</pre><span class="anchor" id="line-331"></span><span class="anchor" id="line-332"></span><p class="line874">Now create /etc/auto.home and insert the following: <span class="anchor" id="line-333"></span><span class="anchor" id="line-334"></span><span class="anchor" id="line-335"></span></p><pre>  *             solarisbox1.company.com.au,solarisbox2.company.com.au:/export/home/&amp;</pre><span class="anchor" id="line-336"></span><p class="line874">The
 above line automatically mounts any directory accessed at 
/home/[username] on the client machine from either 
solarisbox1.company.com.au:/export/home/[username] or 
solarisbox2.company.com.au:/export/home/[username]. <span class="anchor" id="line-337"></span><span class="anchor" id="line-338"></span></p><p class="line874">Restart autofs to enable the configuration: <span class="anchor" id="line-339"></span><span class="anchor" id="line-340"></span><span class="anchor" id="line-341"></span></p><pre>sudo /etc/init.d/autofs start</pre><span class="anchor" id="line-342"></span><span class="anchor" id="line-343"></span><p class="line867">
</p><h4 id="Static Mounts">Static Mounts</h4>
<span class="anchor" id="line-344"></span><span class="anchor" id="line-345"></span><p class="line874">Prior to setting up the mounts, make sure the directories that will act as mountpoints are already created. <span class="anchor" id="line-346"></span><span class="anchor" id="line-347"></span></p><p class="line874">In /etc/fstab, add lines for shares such as: <span class="anchor" id="line-348"></span><span class="anchor" id="line-349"></span><span class="anchor" id="line-350"></span></p><pre>servername:dir /mntpoint nfs rw,hard,intr 0 0</pre><span class="anchor" id="line-351"></span><p class="line862">The <tt>rw</tt> mounts it read/write. Obviously, if the server is sharing <span class="anchor" id="line-352"></span>it read only, <span class="anchor" id="line-353"></span>the client won't be able to mount it as anything more than that. The <span class="anchor" id="line-354"></span><tt>hard</tt> mounts the share such that if the server becomes <span class="anchor" id="line-355"></span>unavailable, the program will wait until it is available. The <span class="anchor" id="line-356"></span>alternative is <tt>soft</tt>. <tt>intr</tt> allows you to interrupt/kill the <span class="anchor" id="line-357"></span>process. Otherwise, it will ignore you. Documentation for these can be <span class="anchor" id="line-358"></span>found in the <tt>Mount&nbsp;options&nbsp;for&nbsp;nfs</tt> section of <tt>man&nbsp;mount</tt>. <span class="anchor" id="line-359"></span><span class="anchor" id="line-360"></span></p><p class="line862">The filesystems can now be mounted with <tt>mount&nbsp;/mountpoint</tt>, or <tt>mount&nbsp;-a</tt> to mount everything that should be mounted at boot. <span class="anchor" id="line-361"></span><span class="anchor" id="line-362"></span></p><p class="line867">
</p><h3 id="Notes">Notes</h3>
<span class="anchor" id="line-363"></span><p class="line867">
</p><h4 id="Minimalistic NFS Set Up">Minimalistic NFS Set Up</h4>
<span class="anchor" id="line-364"></span><span class="anchor" id="line-365"></span><p class="line874">The steps above are very comprehensive. The minimum number of steps required to set up NFS are listed here: <span class="anchor" id="line-366"></span><span class="anchor" id="line-367"></span></p><p class="line867"><a class="http" href="http://www.ubuntuforums.org/showthread.php?t=249889">http://www.ubuntuforums.org/showthread.php?t=249889</a> <span class="anchor" id="line-368"></span><span class="anchor" id="line-369"></span></p><p class="line867">
</p><h4 id="Using Groups with NFS Shares">Using Groups with NFS Shares</h4>
<span class="anchor" id="line-370"></span><p class="line862">When using 
groups on NFS shares (NFSv2 or NFSv3), keep in mind that this might not 
work if a user is a member of more than 16 groups. This is due to 
limitations in the NFS protocol. You can find more information on 
Launchpad (<a class="https" href="https://bugs.launchpad.net/ubuntu/+source/linux-source-2.6.20/+bug/110132">"Permission denied when user belongs to group that owns group writable or setgid directories mounted via nfs"</a>) and in this article: <a class="http" href="http://nfsworld.blogspot.com/2005/03/whats-deal-on-16-group-id-limitation.html">"What's the deal on the 16 group id limitation in NFS?"</a> <span class="anchor" id="line-371"></span><span class="anchor" id="line-372"></span></p><p class="line867">
</p><h2 id="IPSec Notes">IPSec Notes</h2>
<span class="anchor" id="line-373"></span><span class="anchor" id="line-374"></span><p class="line874">If
 you're using IPSec, the default shutdown order in Breezy/Dapper causes 
the client to hang as it's being shut down because IPSec goes down 
before NFS does. To fix it, do: <span class="anchor" id="line-375"></span><span class="anchor" id="line-376"></span></p><p class="line867"><span class="anchor" id="line-377"></span><span class="anchor" id="line-378"></span><span class="anchor" id="line-379"></span></p><pre>sudo update-rc.d -f setkey remove
sudo update-rc.d setkey start 37 0 6 S .</pre><span class="anchor" id="line-380"></span><span class="anchor" id="line-381"></span><p class="line874">A bug has been filed here: <span class="anchor" id="line-382"></span><a class="https" href="https://launchpad.net/distros/ubuntu/+source/ipsec-tools/+bug/37536">https://launchpad.net/distros/ubuntu/+source/ipsec-tools/+bug/37536</a> <span class="anchor" id="line-383"></span><span class="anchor" id="line-384"></span></p><p class="line867">
</p><h2 id="Troubleshooting">Troubleshooting</h2>
<span class="anchor" id="line-385"></span><span class="anchor" id="line-386"></span><p class="line867">
</p><h3 id="Mounting NFS shares in encrypted home won't work on boot">Mounting NFS shares in encrypted home won't work on boot</h3>
<span class="anchor" id="line-387"></span><span class="anchor" id="line-388"></span><p class="line862">Mounting
 an NFS share inside an encrypted home directory will only work after 
you are successfully logged in and your home is decrypted. This means 
that using <tt>/etc/fstab</tt> to mount NFS shares on boot will not work
 - because your home has not been decrypted at the time of mounting. 
There is a simple way around this using Symbolic links: <span class="anchor" id="line-389"></span><span class="anchor" id="line-390"></span></p><ul><li>Create an alternative directory to mount the NFS shares in: <span class="anchor" id="line-391"></span></li></ul><p class="line867"><span class="anchor" id="line-392"></span><span class="anchor" id="line-393"></span><span class="anchor" id="line-394"></span></p><pre>$ sudo mkdir /nfs
$ sudo mkdir /nfs/music</pre><span class="anchor" id="line-395"></span><span class="anchor" id="line-396"></span><ul><li><p class="line862">Edit <tt>/etc/fstab</tt> to mount the NFS share into that directory instead: <span class="anchor" id="line-397"></span></p></li></ul><p class="line867"><tt>nfsServer:music&nbsp;&nbsp;&nbsp;&nbsp;/nfs/music&nbsp;&nbsp;&nbsp;&nbsp;nfs4&nbsp;&nbsp;&nbsp;&nbsp;_netdev,auto&nbsp;&nbsp;&nbsp;&nbsp;0&nbsp;0</tt> <span class="anchor" id="line-398"></span><span class="anchor" id="line-399"></span></p><ul><li>Create
 a symbolic link inside your home, pointing to the actual mount location
 (in our case delete the 'Muisc' directory already existing there 
first): <span class="anchor" id="line-400"></span></li></ul><p class="line867"><span class="anchor" id="line-401"></span><span class="anchor" id="line-402"></span><span class="anchor" id="line-403"></span></p><pre>$ rmdir /home/user/Music
$ ln -s /nfs/music/ /home/user/Music</pre><span class="anchor" id="line-404"></span><span class="anchor" id="line-405"></span><p class="line867">
</p><h2 id="links">links</h2>
<span class="anchor" id="line-406"></span><span class="anchor" id="line-407"></span><ul><li><p class="line891"><a class="http" href="http://www.nfsv4.org/">http://www.nfsv4.org/</a> <span class="anchor" id="line-408"></span><span class="anchor" id="line-409"></span></p></li></ul><p class="line867">
</p><h2 id="Credits">Credits</h2>
<span class="anchor" id="line-410"></span><span class="anchor" id="line-411"></span><ul><li>feisar - Introduction, NFSv4 quickstart (adapted from NFSv4Howto), Troubleshooting: Mount encrypted home. <span class="anchor" id="line-412"></span></li><li><p class="line891"><a class="nonexistent" href="https://help.ubuntu.com/community/MatthewCaron">MatthewCaron</a> - NFS Server, NFS Client, IPSec Notes <span class="anchor" id="line-413"></span></p></li><li><p class="line891"><a href="https://help.ubuntu.com/community/NaamanCampbell">NaamanCampbell</a> - NFS Client - Automount <span class="anchor" id="line-414"></span><span class="anchor" id="line-415"></span></p></li></ul><p class="line867"></p><hr><p class="line874"> <span class="anchor" id="line-416"></span><span class="anchor" id="bottom"></span></p></div><p id="pageinfo" class="info" dir="ltr" lang="en">SettingUpNFSHowTo  (last edited 2011-03-02 17:46:58 by <span title="https://login.launchpad.net/+id/ytYHYKR @ 64.101.76.132[64.101.76.132]"><a class="interwiki" href="https://launchpad.net/%7Erbeede" title="https://login.launchpad.net/+id/ytYHYKR @ 64.101.76.132[64.101.76.132]">rbeede</a></span>)</p>

<ul class="pagelinks">
<li><a class="nbinfo" href="https://help.ubuntu.com/community/SettingUpNFSHowTo?action=info" rel="nofollow">Page History</a></li>
</ul>

<div id="pagebottom"></div>
</div>


<div id="footer">
<hr width="550px">

  <div id="ubuntulinks">
	<p>
	      The material on this wiki is available under a free license, see <a href="https://help.ubuntu.com/community/License">Copyright / License</a> for details<br><b>You</b> can contribute to this wiki, see <a href="https://help.ubuntu.com/community/WikiGuide">Wiki Guide</a> for details
	</p><br>
  </div>
<script src="SettingUpNFSHowTo_files/urchin.js" type="text/javascript">
</script>
<script type="text/javascript">
_uacct = "UA-1018242-7";
urchinTracker();
__utmSetVar('UbuntuWiki');
</script>
<script type="text/javascript">
function togglebar() {
    obj = document.getElementById('editbar');
    obj2 = document.getElementById('showbarspan');
    obj3 = document.getElementById('showbar');
    if (obj.style.position == 'fixed') {
        obj.style.position = 'static';
	obj3.style.bottom = '0';
        obj2.innerHTML = 'Show';
    } else {
        obj.style.position = 'fixed';
        obj2.innerHTML = 'Hide';
        obj3.style.bottom = '25px';
    }
    return false;
}
</script>


</div> <!-- footer -->
</div> <!-- layout -->
<img id="bottomcap" alt="" src="SettingUpNFSHowTo_files/cap-bottom.png">
</div> <!-- round -->
</body></html>